Re: [Pqc] Guidance for runnning Stateful Hash-Based Signatures

[Hubert Kario <[e-mail]>]

The issue with export is that you have a state that can be duplicated.

So any kind of transfer needs to be an online protocol that ensures
that the key cannot be duplicated as part of the transfer, even at the
cost of losing the key if the transfer process is interrupted.

On Tuesday, 19 March 2024 09:08:07 CET, Thom Wiggers wrote:
> Hi all,
>
> As I just presented at the IETF 119 PQUIP meeting, we got 
> together with a bunch of people to write down as much as we 
> could think of on how you can build reliably and safely on top 
> of stateful hash-based signature schemes (if you can’t just 
> avoid them, which you likely SHOULD).
>
> We set out to document stuff ranging from operational 
> considerations like staff training, discuss things mentioned in 
> SP800-208 such as how you can have split trees in multiple 
> signers, discuss what one should consider in certain alternative 
> approaches to state management for specific scenarios, and also 
> include some approaches to backup management that go a little 
> bit beyond what SP800-208 allows (as it currently bans all forms 
> of key export).
>
> The initial version of our draft can be found 
> at https://datatracker.ietf.org/doc/draft-wiggers-hbs-state/  
> and it lives on Github at 
> https://github.com/hbs-guidance/draft-hbs-state.
>
> We are looking forward to having productive discussions with 
> everyone to make this document as complete as possible. We 
> already have a good discussion point for some new content in the 
> issue tracker: should we include a paragraph on “when are S-HBS 
> schemes appropriate in the first place?”.
>
> On behalf of my co-authors,
>
> Cheers,
>
> Thom 

-- 
Regards,
Hubert Kario
Principal Quality Engineer, RHEL Crypto team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00, Brno, Czech Republic